Spectre bug is back, this time to haunt JIT engines
ID: d378d5aa-132e-5031-9e89-fe7c14c4ad53
STIX ID: report--d378d5aa-132e-5031-9e89-fe7c14c4ad53
Feed Name: The Register (Security)
Researchers disclosed a Spectre v2 variant named Branch Target Reuse (BTR) that enables in-place attacks against JIT compilers (e.g., Linux cBPF, Oracle GraalVM, Mozilla SpiderMonkey) by reusing stale indirect branch prediction targets; proof-of-concept exploits demonstrate the ability to leak secrets (such as root password hashes) from Intel-based Linux kernels, two CVEs were assigned (CVE-2026-64507 and CVE-2026-64508), and mitigations have been implemented though some defenses are complex or performance-impacting.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.